poe-code 14.0.62 → 14.0.64

package/packages/safe-js/dist/chunks/{chunk-VKGWGZBH.js → chunk-XO7B4P27.js}

@@ -6448,8 +6448,50 @@ function nativeIterator(collection, method) {
   return collection.kind === "map" ? collection.entries[method]() : collection.values[method]();
 }
 
-// packages/safe-js/src/interp/host-capabilities.ts
+// packages/safe-js/src/interp/boxed.ts
 import { types as types3 } from "node:util";
+var boxes = /* @__PURE__ */ new WeakSet();
+var numberValue = Number.prototype.valueOf;
+var stringValue = String.prototype.valueOf;
+var booleanValue = Boolean.prototype.valueOf;
+function nativeBoxedValue(value) {
+  if (types3.isNumberObject(value)) return Reflect.apply(numberValue, value, []);
+  if (types3.isStringObject(value)) return Reflect.apply(stringValue, value, []);
+  if (types3.isBooleanObject(value)) return Reflect.apply(booleanValue, value, []);
+  return void 0;
+}
+function createSandboxBox(value) {
+  if (typeof value !== "number" && typeof value !== "string" && typeof value !== "boolean")
+    throw new TypeError("Invalid boxed primitive payload.");
+  const box = Object(value);
+  Object.setPrototypeOf(box, null);
+  boxes.add(box);
+  return box;
+}
+function isSandboxBox(value) {
+  return typeof value === "object" && value !== null && boxes.has(value);
+}
+function boxedValue(value) {
+  if (!boxes.has(value)) throw new TypeError("Expected a sandbox boxed primitive.");
+  return nativeBoxedValue(value);
+}
+function primitiveReceiver(value, kind) {
+  const primitive = isSandboxBox(value) ? boxedValue(value) : value;
+  if (typeof primitive !== kind) throw new TypeError(`${kind} method requires a ${kind} receiver.`);
+  return primitive;
+}
+function boxedDataProperties(value) {
+  const primitive = nativeBoxedValue(value);
+  return Object.entries(Object.getOwnPropertyDescriptors(value)).filter(([key]) => {
+    if (typeof primitive !== "string") return true;
+    if (key === "length") return false;
+    const index = Number(key);
+    return !(Number.isInteger(index) && index >= 0 && index < primitive.length && String(index) === key);
+  });
+}
+
+// packages/safe-js/src/interp/host-capabilities.ts
+import { types as types4 } from "node:util";
 var MAX_INDEXED_LENGTH = 65536;
 var MAX_NAMED_KEYS = 65536;
 var MAX_NAMED_KEY_CODE_UNITS = 1048576;
@@ -6504,7 +6546,7 @@ function createLiveHostObject(definition, controller) {
     for (const name of ["keys", "get", "set", "delete"]) {
       const operation = data[name];
       if (operation === void 0 && (name === "set" || name === "delete")) continue;
-      if (typeof operation !== "function" || types3.isProxy(operation) || types3.isAsyncFunction(operation) || types3.isGeneratorFunction(operation))
+      if (typeof operation !== "function" || types4.isProxy(operation) || types4.isAsyncFunction(operation) || types4.isGeneratorFunction(operation))
         throw new TypeError(`Named ${name} must be a synchronous non-generator function, not a proxy.`);
     }
     if (typeof data.maxKeys !== "number" || !Number.isInteger(data.maxKeys) || data.maxKeys < 1 || data.maxKeys > MAX_NAMED_KEYS)
@@ -6759,7 +6801,7 @@ function namedMutationKeys(state, key, create) {
 function namedKeys(state) {
   const named = state.named;
   return state.controller.read(named.keys, (value) => {
-    if (!Array.isArray(value) || types3.isProxy(value))
+    if (!Array.isArray(value) || types4.isProxy(value))
       throw new TypeError("Named keys must be a dense own-data array of strings, not a proxy.");
     const length = Object.getOwnPropertyDescriptor(value, "length").value;
     if (length > named.maxKeys) throw new RangeError("Named keys exceed maxKeys.");
@@ -6912,7 +6954,7 @@ async function flushPromiseJobs() {
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
 
 // packages/safe-js/src/snapshot/validation.ts
-import { types as types4 } from "node:util";
+import { types as types5 } from "node:util";
 
 // packages/safe-js/src/interp/arguments.ts
 var sandboxArgumentsBrand = /* @__PURE__ */ Symbol("SandboxArguments");
@@ -7017,6 +7059,7 @@ function walkGraphDepth(root, rootPath, assertDepth) {
   }
 }
 function graphEntries(value) {
+  if (isSandboxBox(value)) return boxedDataProperties(value).map(([key, descriptor]) => [`.${key}`, descriptor.value]);
   if (isSandboxArguments(value)) {
     return getSandboxArgumentEntries(value).map(([key, entry]) => [`.${key}`, entry]);
   }
@@ -7046,7 +7089,10 @@ var guestClosures = /* @__PURE__ */ new WeakSet();
 var functionProperties = /* @__PURE__ */ new WeakMap();
 var prototypes = /* @__PURE__ */ new WeakMap();
 var intrinsicPrototypes = /* @__PURE__ */ new WeakMap();
+var boxedPrototypes = /* @__PURE__ */ new WeakMap();
+var intrinsicPrototypeRoots = /* @__PURE__ */ new WeakMap();
 var intrinsicConstructors = /* @__PURE__ */ new WeakMap();
+var initialBoxedMethods = /* @__PURE__ */ new WeakMap();
 var descriptorObjects = /* @__PURE__ */ new WeakSet();
 function registerGuestClosure(closure) {
   guestClosures.add(closure);
@@ -7094,25 +7140,61 @@ function getGuestFunctionProperty(closure, key) {
 function installObjectPrototype(budget, prototype, constructor) {
   prototypes.set(prototype, null);
   intrinsicPrototypes.set(budget, prototype);
-  const records = [prototype, materializeFunctionProperties(constructor)].map((value) => ({
-    value,
-    descriptors: new Map(Object.entries(Object.getOwnPropertyDescriptors(value)))
+  registerIntrinsicPrototype(budget, prototype, constructor);
+}
+function installBoxedPrototype(budget, prototype, constructor) {
+  let state = boxedPrototypes.get(budget);
+  if (state === void 0) boxedPrototypes.set(budget, state = /* @__PURE__ */ new Map());
+  state.set(typeof boxedValue(prototype), prototype);
+  initialBoxedMethods.set(prototype, new Map(Object.entries(Object.getOwnPropertyDescriptors(prototype)).map(([key, descriptor]) => [key, descriptor.value])));
+  registerIntrinsicPrototype(budget, prototype, constructor);
+}
+function getBoxedPrototype(value, budget) {
+  return boxedPrototypes.get(budget)?.get(typeof value);
+}
+function isDefaultBoxedMethod(value, key, budget) {
+  const prototype = getBoxedPrototype(value, budget);
+  return prototype !== void 0 && initialBoxedMethods.get(prototype)?.has(key) === true && Object.getOwnPropertyDescriptor(prototype, key)?.value === initialBoxedMethods.get(prototype)?.get(key);
+}
+function isIntrinsicConstructor(value) {
+  return intrinsicConstructors.has(value);
+}
+function registerIntrinsicPrototype(budget, prototype, constructor) {
+  let roots = intrinsicPrototypeRoots.get(budget);
+  if (roots === void 0) intrinsicPrototypeRoots.set(budget, roots = /* @__PURE__ */ new Set());
+  roots.add(prototype);
+  const records = [prototype, constructor].map((target) => ({
+    target,
+    value: isGuestClosure(target) ? materializeFunctionProperties(target) : target,
+    prototype: getSandboxPrototype(target),
+    explicit: hasExplicitSandboxPrototype(target)
+  })).map((record2) => ({
+    ...record2,
+    descriptors: new Map(Object.entries(Object.getOwnPropertyDescriptors(record2.value)))
   }));
-  const unchanged = (before, after) => before !== void 0 && after !== void 0 && before.value === after.value && before.writable === after.writable && before.configurable === after.configurable && before.enumerable === after.enumerable;
-  intrinsicConstructors.set(constructor, () => records.every(({ value, descriptors }) => {
+  const unchanged = (before, after) => before !== void 0 && after !== void 0 && Object.is(before.value, after.value) && before.writable === after.writable && before.configurable === after.configurable && before.enumerable === after.enumerable;
+  intrinsicConstructors.set(constructor, () => records.every(({ target, value, descriptors, prototype: parent, explicit }) => {
     const current = Object.getOwnPropertyDescriptors(value);
-    return Object.keys(current).length === descriptors.size && Object.keys(current).every((key) => unchanged(descriptors.get(key), current[key]));
+    return getSandboxPrototype(target) === parent && hasExplicitSandboxPrototype(target) === explicit && Object.keys(current).length === descriptors.size && Object.keys(current).every((key) => unchanged(descriptors.get(key), current[key]));
   }));
-  budget.setRetainedValues(prototype, () => records.flatMap(({ value, descriptors }) => Object.entries(Object.getOwnPropertyDescriptors(value)).flatMap(([key, descriptor]) => unchanged(descriptors.get(key), descriptor) ? [] : [key, descriptor.value])));
+  budget.setRetainedValues(prototype, () => records.flatMap(({ target, value, descriptors, prototype: parent }) => [
+    ...getSandboxPrototype(target) === parent ? [] : [getSandboxPrototype(target)],
+    ...Object.entries(Object.getOwnPropertyDescriptors(value)).flatMap(([key, descriptor]) => unchanged(descriptors.get(key), descriptor) ? [] : [key, descriptor.value])
+  ]));
 }
 function releaseObjectPrototype(budget) {
-  const prototype = intrinsicPrototypes.get(budget);
-  if (prototype !== void 0) budget.setRetainedValues(prototype, void 0);
+  for (const prototype of intrinsicPrototypeRoots.get(budget) ?? []) budget.setRetainedValues(prototype, void 0);
+  intrinsicPrototypeRoots.delete(budget);
+  boxedPrototypes.delete(budget);
   intrinsicPrototypes.delete(budget);
 }
 function getSandboxPrototype(value, budget) {
   if (prototypes.has(value)) return prototypes.get(value) ?? null;
-  return budget !== void 0 && isPrototypeRecord(value) ? intrinsicPrototypes.get(budget) ?? null : null;
+  if (budget !== void 0 && isSandboxBox(value)) {
+    const prototype = getBoxedPrototype(boxedValue(value), budget);
+    if (prototype !== void 0 && prototype !== value) return prototype;
+  }
+  return budget !== void 0 && !isSandboxClosure(value) && isPrototypeRecord(value) ? intrinsicPrototypes.get(budget) ?? null : null;
 }
 function hasExplicitSandboxPrototype(value) {
   return prototypes.has(value);
@@ -7122,14 +7204,16 @@ function getSandboxDataProperty(value, key, budget) {
   let depth = 0;
   while (typeof current === "object" && current !== null) {
     if (isGuestHostObject(current)) return getHostObjectMember(current, String(key));
-    if (isGuestClosure(current)) return getGuestFunctionProperty(current, String(key));
-    if (isSandboxClosure(current)) {
+    if (isGuestClosure(current)) {
+      const entry = getGuestFunctionProperty(current, String(key));
+      if (entry !== void 0 || Object.hasOwn(current.properties ?? {}, String(key))) return entry;
+    } else if (isSandboxClosure(current)) {
       const properties = current.properties;
       return properties !== void 0 && Object.hasOwn(properties, String(key)) ? properties[String(key)] : void 0;
     }
     if (isSandboxMap(current) || isSandboxSet(current) || isSandboxPromise(current) || isSandboxRegex(current) || isSandboxGenerator(current))
       return void 0;
-    if (Object.hasOwn(current, String(key))) return current[String(key)];
+    if (!isSandboxClosure(current) && Object.hasOwn(current, String(key))) return current[String(key)];
     current = getSandboxPrototype(current, budget);
     if (current !== null) {
       budget?.visitNode();
@@ -7144,7 +7228,7 @@ function setSandboxPrototype(value, prototype, budget) {
   }
   if (!isPrototypeRecord(value) || prototype !== null && !isPrototypeRecord(prototype)) {
     throw new TypeError(
-      "Prototype links require ordinary sandbox objects; callable and exotic prototype chains are not supported."
+      "Prototype links require ordinary sandbox objects or guest functions."
     );
   }
   if (prototypes.has(value) && getSandboxPrototype(value, budget) === prototype) return;
@@ -7160,6 +7244,7 @@ function setSandboxPrototype(value, prototype, budget) {
   prototypes.set(value, prototype);
 }
 function isPrototypeRecord(value) {
+  if (isGuestClosure(value)) return true;
   if (isGuestHostObject(value)) return false;
   if (isSandboxClosure(value) || isSandboxGenerator(value) || isSandboxMap(value) || isSandboxPromise(value) || isSandboxRegex(value) || isSandboxSet(value))
     return false;
@@ -7177,6 +7262,7 @@ function hasGuestObjectState(value) {
   if (intrinsicUnchanged !== void 0) return !intrinsicUnchanged();
   if (isLiveCapability(value)) return true;
   if (functionProperties.has(value) || prototypes.has(value)) return true;
+  if (isSandboxBox(value)) return false;
   return descriptorObjects.has(value) && Object.values(Object.getOwnPropertyDescriptors(value)).some(
     (descriptor) => !descriptor.enumerable || !descriptor.configurable || !descriptor.writable
   );
@@ -7280,6 +7366,34 @@ function decodeFloat32Storage(value, resolve) {
   return new Float32Array(buffer, Number(value.byteOffset), Number(value.length));
 }
 
+// packages/safe-js/src/snapshot/boxed.ts
+function encodeBoxedData(value, encode) {
+  const properties = /* @__PURE__ */ Object.create(null);
+  for (const [key, descriptor] of boxedDataProperties(value)) {
+    if (!("value" in descriptor)) throw new TypeError("Boxed data cannot contain accessors.");
+    properties[key] = {
+      value: encode(descriptor.value, key),
+      configurable: descriptor.configurable === true,
+      enumerable: descriptor.enumerable === true,
+      writable: descriptor.writable === true
+    };
+  }
+  return {
+    kind: "boxed",
+    value: encode(boxedValue(value), "<payload>"),
+    properties,
+    extensible: Object.isExtensible(value)
+  };
+}
+function validateBoxedProperties(data) {
+  if (!Object.hasOwn(data, "kind") || data.kind !== "boxed" || !Object.hasOwn(data, "value") || !Object.hasOwn(data, "extensible") || !Object.hasOwn(data, "properties") || Object.keys(data).length !== 4 || typeof data.extensible !== "boolean" || typeof data.properties !== "object" || data.properties === null || Array.isArray(data.properties))
+    throw new TypeError("Invalid boxed primitive properties.");
+  for (const descriptor of Object.values(data.properties)) {
+    if (typeof descriptor !== "object" || descriptor === null || !Object.hasOwn(descriptor, "value") || !Object.hasOwn(descriptor, "writable") || !Object.hasOwn(descriptor, "enumerable") || !Object.hasOwn(descriptor, "configurable") || typeof descriptor.writable !== "boolean" || typeof descriptor.enumerable !== "boolean" || typeof descriptor.configurable !== "boolean" || Object.keys(descriptor).length !== 4)
+      throw new TypeError("Invalid boxed primitive descriptor.");
+  }
+}
+
 // packages/safe-js/src/snapshot/dump-format.ts
 var DUMP_FORMAT_VERSION = 1;
 var EXECUTION_SEMANTICS = "jobs-v8";
@@ -7341,7 +7455,7 @@ function serializeDumpValue(value, path, state) {
   if (hasGuestObjectState(value)) {
     throw new TypeError("Guest function properties and prototype links cannot be serialized.");
   }
-  if (isSandboxDate(value) || isFloat32Array(value)) return serializeHeapReference(value, path, state);
+  if (isSandboxBox(value) || isSandboxDate(value) || isFloat32Array(value)) return serializeHeapReference(value, path, state);
   if (Array.isArray(value)) {
     const reference2 = serializeHeapReference(value, path, state);
     if (reference2 !== void 0) {
@@ -7365,7 +7479,13 @@ function serializeHeapReference(value, path, state) {
   }
   if (!state.serializedHeapIds.has(id)) {
     state.serializedHeapIds.add(id);
-    if (isSandboxDate(value)) {
+    if (isSandboxBox(value)) {
+      state.heap[String(id)] = encodeBoxedData(value, (entry, key) => {
+        if (Object.is(entry, -0)) return { kind: "number", value: "-0" };
+        const serialized = serializeDumpValue(entry, `${path}.${key}`, state);
+        return serialized === SKIP_VALUE ? { kind: "undefined" } : serialized;
+      });
+    } else if (isSandboxDate(value)) {
       state.heap[String(id)] = { kind: "date", time: serializedDateTime(value) };
     } else if (isFloat32Array(value)) {
       const storage = encodeFloat32Storage(value, id, state.float32Buffers, (id2) => ({
@@ -7424,7 +7544,7 @@ function indexHeapContainers(snapshot) {
   const heapIds = /* @__PURE__ */ new WeakMap();
   let nextId = 1;
   for (const [value, stat2] of stats.entries()) {
-    if (stat2.count > 1 || stat2.cyclic || isSandboxDate(value) || isFloat32Array(value) || Array.isArray(value) && requiresArrayEntries(value) || isSandboxArguments(value) || sandboxErrorTypes.has(value)) {
+    if (stat2.count > 1 || stat2.cyclic || isSandboxBox(value) || isSandboxDate(value) || isFloat32Array(value) || Array.isArray(value) && requiresArrayEntries(value) || isSandboxArguments(value) || sandboxErrorTypes.has(value)) {
       heapIds.set(value, nextId);
       nextId += 1;
     }
@@ -7457,7 +7577,7 @@ function collectContainerStats(value, stats, ancestors) {
   }
   stat2.expanded = true;
   ancestors.add(value);
-  const entries = isSandboxArguments(value) ? getSandboxArgumentEntries(value).map(([, entry]) => entry) : getEnumerableDataValues(value);
+  const entries = isSandboxBox(value) ? boxedDataProperties(value).map(([, descriptor]) => descriptor.value) : isSandboxArguments(value) ? getSandboxArgumentEntries(value).map(([, entry]) => entry) : getEnumerableDataValues(value);
   for (const entry of entries) {
     collectContainerStats(entry, stats, ancestors);
   }
@@ -7571,6 +7691,10 @@ function validateDumpHeap(root, state) {
     addUnique(heapIds, id, path);
     const entry = requireRecord(value, path);
     validateErrorType(entry, path);
+    if (entry.kind === "boxed") {
+      validateBoxedRecord(entry, path);
+      continue;
+    }
     if (entry.kind === "date") {
       validateDateRecord(entry, path);
       continue;
@@ -7738,6 +7862,18 @@ function validateGeneratorShape(record2, path, state) {
     }
   });
 }
+function validateBoxedRecord(record2, path) {
+  try {
+    validateBoxedProperties(record2);
+  } catch {
+    fail("invalidValue", path, "invalid boxed primitive properties");
+  }
+  const value = record2.value;
+  if (typeof value === "number" || typeof value === "string" || typeof value === "boolean") return;
+  const number = requireRecord(value, `${path}.value`);
+  if (number.kind !== "number" || !["NaN", "Infinity", "-Infinity", "-0"].includes(String(number.value)))
+    fail("invalidValue", `${path}.value`, "invalid boxed primitive payload");
+}
 function validateDateRecord(record2, path) {
   if (Object.keys(record2).length !== 2) fail("invalidValue", path, "invalid Date fields");
   try {
@@ -7829,7 +7965,7 @@ function validateGenericValue(value, path, depth, state) {
   if (typeof value === "object" && value !== null && hasGuestObjectState(value)) {
     fail("invalidState", path, "guest function properties, prototype links and custom descriptors cannot be restored");
   }
-  if (state.dataPropertiesOnly && types4.isProxy(value)) {
+  if (state.dataPropertiesOnly && types5.isProxy(value)) {
     fail("invalidType", path, "proxy objects are not snapshot data");
   }
   if (depth > state.limits.maxDepth)
@@ -8754,7 +8890,7 @@ async function objectToPrimitive(value, budget, context, joining, hint) {
       if (hook === defaultStringHook) {
         result = await defaultToString(value, budget, context, joining);
       } else if (hook === defaultValueHook) {
-        result = isSandboxDate(value) ? dateTime(value) : value;
+        result = isSandboxDate(value) ? dateTime(value) : isSandboxBox(value) ? boxedValue(value) : value;
       } else {
         if (!isSandboxClosure(hook)) continue;
         result = await invokeBuiltinClosure(hook, [], budget, context, value);
@@ -8794,6 +8930,7 @@ function conversionHook(value, name, budget) {
   return void 0;
 }
 async function defaultToString(value, budget, context, joining) {
+  if (isSandboxBox(value)) return budget.allocateString(String(boxedValue(value)));
   if (isSandboxClosure(value)) return budget.allocateString(functionString(value));
   if (isSandboxMap(value)) return "[object Map]";
   if (isSandboxSet(value)) return "[object Set]";
@@ -9350,7 +9487,27 @@ function assertSnapshotInactive(snapshot) {
 }
 
 // packages/safe-js/src/interp/iteration.ts
-function getSandboxIterator(value, budget) {
+function getSandboxIterator(value, budget, context) {
+  if (isSandboxBox(value) && typeof boxedValue(value) === "string") {
+    const primitive = boxedValue(value);
+    let text;
+    let iterator;
+    let initialized;
+    return {
+      asynchronous: true,
+      get retainedValue() {
+        return text === primitive ? void 0 : text;
+      },
+      next: async () => {
+        initialized ??= Promise.resolve(sandboxString(value, budget ?? new Budget(), context)).then((converted) => {
+          text = converted;
+          iterator = syncIterator(converted[Symbol.iterator]());
+        });
+        await initialized;
+        return iterator.next();
+      }
+    };
+  }
   if (isSandboxCollectionIterator(value)) return { next: () => nextCollectionIterator(value, budget), snapshotIndex: () => 0 };
   if (isGuestHostObject(value)) return getHostObjectIterator(value);
   if (isFloat32Array(value)) {
@@ -9917,67 +10074,72 @@ async function settleIterable(iterable, method, budget, constructor, context) {
     const promiseResolve = readPromiseReceiverProperty(constructor, "resolve", prototype);
     if (!isSandboxClosure(promiseResolve))
       throw new TypeError("Promise constructor requires a callable resolve.");
-    const iterator = getSandboxIterator(iterable, budget);
+    const iterator = getSandboxIterator(iterable, budget, context);
     if (iterator === void 0) throw new TypeError("Promise helpers require an iterable.");
-    let index = 0;
-    while (true) {
-      budget.visitNode();
-      const next = iterator.generator ? await iterator.next() : iterator.next();
-      if (typeof next !== "object" || next === null)
-        throw new TypeError("Iterator result must be an object.");
-      if (next.done) break;
-      const value = next.value;
-      try {
-        budget.allocateArrayLength(index + 1);
-        const entryIndex = index++;
-        if (method !== "race") values.push(void 0);
-        const entry = await callPromiseClosure(
-          promiseResolve,
-          [value],
-          constructor,
-          budget,
-          context
-        );
-        let called = false;
-        const handlers = ["fulfilled", "rejected"].map((state) => {
-          if (method === "race" || method === "any" && state === "fulfilled")
-            return state === "fulfilled" ? capability.resolve : capability.reject;
-          if (method === "all" && state === "rejected") return capability.reject;
-          return createSandboxClosure({
-            sandbox: true,
-            retainedValues: () => [
-              capability.promise,
-              capability.resolve,
-              capability.reject,
-              values
-            ],
-            call: async ([settlement]) => {
-              if (called) return void 0;
-              called = true;
-              values[entryIndex] = method === "allSettled" ? state === "fulfilled" ? { status: state, value: settlement } : { status: state, reason: settlement } : settlement;
-              remaining--;
-              await complete();
-              return void 0;
-            }
-          });
-        });
-        remaining++;
-        const then = readPromiseReceiverProperty(entry, "then", prototype);
-        if (!isSandboxClosure(then))
-          throw new TypeError("Promise resolver result requires a callable then.");
-        await callPromiseClosure(then, handlers, entry, budget, context);
-      } catch (error) {
+    const releaseIterator = retainValues(budget, () => [iterator.retainedValue]);
+    try {
+      let index = 0;
+      while (true) {
+        budget.visitNode();
+        const next = iterator.generator || iterator.asynchronous ? await iterator.next() : iterator.next();
+        if (typeof next !== "object" || next === null)
+          throw new TypeError("Iterator result must be an object.");
+        if (next.done) break;
+        const value = next.value;
         try {
-          const closed = iterator.return?.();
-          if (iterator.generator) await closed;
-        } catch {
+          budget.allocateArrayLength(index + 1);
+          const entryIndex = index++;
+          if (method !== "race") values.push(void 0);
+          const entry = await callPromiseClosure(
+            promiseResolve,
+            [value],
+            constructor,
+            budget,
+            context
+          );
+          let called = false;
+          const handlers = ["fulfilled", "rejected"].map((state) => {
+            if (method === "race" || method === "any" && state === "fulfilled")
+              return state === "fulfilled" ? capability.resolve : capability.reject;
+            if (method === "all" && state === "rejected") return capability.reject;
+            return createSandboxClosure({
+              sandbox: true,
+              retainedValues: () => [
+                capability.promise,
+                capability.resolve,
+                capability.reject,
+                values
+              ],
+              call: async ([settlement]) => {
+                if (called) return void 0;
+                called = true;
+                values[entryIndex] = method === "allSettled" ? state === "fulfilled" ? { status: state, value: settlement } : { status: state, reason: settlement } : settlement;
+                remaining--;
+                await complete();
+                return void 0;
+              }
+            });
+          });
+          remaining++;
+          const then = readPromiseReceiverProperty(entry, "then", prototype);
+          if (!isSandboxClosure(then))
+            throw new TypeError("Promise resolver result requires a callable then.");
+          await callPromiseClosure(then, handlers, entry, budget, context);
+        } catch (error) {
+          try {
+            const closed = iterator.return?.();
+            if (iterator.generator || iterator.asynchronous) await closed;
+          } catch {
+            throw error;
+          }
           throw error;
         }
-        throw error;
       }
+      remaining--;
+      await complete();
+    } finally {
+      releaseIterator();
     }
-    remaining--;
-    await complete();
   } catch (error) {
     if (error instanceof SandboxError && (error.code === "budgetExceeded" || error.code === "reentry")) {
       if (isSandboxPromise(capability.promise)) observeSandboxPromise(capability.promise);
@@ -10679,6 +10841,17 @@ function measureSandboxData(values, options = {}) {
     assertSandboxDataDepth(depth);
     seen.add(value);
     usage += 1;
+    if (isSandboxBox(value)) {
+      const primitive = boxedValue(value);
+      usage += typeof primitive === "string" ? primitive.length : 8;
+      const prototype2 = getSandboxPrototype(value);
+      if (prototype2 !== null) visit(prototype2, depth + 1);
+      for (const [key, descriptor] of boxedDataProperties(value)) {
+        usage += key.length + 1;
+        if ("value" in descriptor) visit(descriptor.value, depth + 1);
+      }
+      return;
+    }
     if (isSandboxDate(value)) {
       usage += 8;
       return;
@@ -10740,7 +10913,15 @@ function measureSandboxData(values, options = {}) {
     }
     if (isSandboxClosure(value)) {
       if (options.ignoreClosures) return;
-      if (value.properties !== void 0) visit(value.properties, depth + 1);
+      if (value.properties !== void 0) {
+        if (isIntrinsicConstructor(value)) {
+          for (const [key, descriptor] of Object.entries(Object.getOwnPropertyDescriptors(value.properties))) {
+            if (key === "prototype" || key === "name" || key === "length") continue;
+            usage += key.length + 1;
+            if ("value" in descriptor) visit(descriptor.value, depth + 1);
+          }
+        } else visit(value.properties, depth + 1);
+      }
       if (!options.ignoreClosureCaptures)
         for (const retained of value[sandboxRetainedValues]?.() ?? []) visit(retained, depth + 1);
       return;
@@ -10872,6 +11053,24 @@ function copyToSandbox(value, state, path = "<root>", cloneSandboxCollections =
   if (typeof value === "object" && value !== null && hasGuestObjectState(value)) {
     throw new TypeError("Guest prototype links and custom descriptors cannot be copied as data.");
   }
+  const primitive = nativeBoxedValue(value);
+  if (primitive !== void 0) {
+    const original = value;
+    const existing = state.seen.get(original);
+    if (existing !== void 0) return existing;
+    const copy = createSandboxBox(primitive);
+    state.seen.set(original, copy);
+    if (!state.structuredClone) {
+      for (const [key, descriptor] of boxedDataProperties(original)) {
+        if (!("value" in descriptor)) throw new TypeError("Boxed data cannot contain accessors.");
+        Object.defineProperty(copy, key, {
+          ...descriptor,
+          value: copyToSandbox(descriptor.value, state, joinPath(path, key), cloneSandboxCollections, depth + 1)
+        });
+      }
+    }
+    return copy;
+  }
   if (isSandboxMap(value)) {
     if (!cloneSandboxCollections) return value;
     const existing = state.seen.get(value);
@@ -11044,6 +11243,20 @@ function copyFromSandbox(value, state, path = "<root>", options, depth = 0) {
   if (!isSandboxClosure(value) && hasGuestObjectState(value)) {
     throw new TypeError("Guest prototype links and custom descriptors cannot be copied as data.");
   }
+  if (isSandboxBox(value)) {
+    const existing = state.seen.get(value);
+    if (existing !== void 0) return existing;
+    const copy = Object(boxedValue(value));
+    state.seen.set(value, copy);
+    for (const [key, descriptor] of boxedDataProperties(value)) {
+      if (!("value" in descriptor)) throw new TypeError("Boxed data cannot contain accessors.");
+      Object.defineProperty(copy, key, {
+        ...descriptor,
+        value: copyFromSandbox(descriptor.value, state, joinPath(path, key), options, depth + 1)
+      });
+    }
+    return copy;
+  }
   const regexBrand = Object.getOwnPropertyDescriptor(value, sandboxRegexBrand);
   if (regexBrand !== void 0) {
     if (!("value" in regexBrand) || regexBrand.value !== true) {
@@ -11214,6 +11427,17 @@ function allocateSandboxValue2(value, budget, seen) {
     budget.allocateString(value);
     return;
   }
+  if (isSandboxBox(value)) {
+    if (seen.has(value)) return;
+    seen.add(value);
+    const primitive = boxedValue(value);
+    if (typeof primitive === "string") budget.allocateString(primitive);
+    for (const [key, descriptor] of boxedDataProperties(value)) {
+      budget.allocateString(key);
+      if ("value" in descriptor) allocateSandboxValue2(descriptor.value, budget, seen);
+    }
+    return;
+  }
   if (isFloat32Array(value)) {
     if (seen.has(value)) return;
     seen.add(value);
@@ -11403,6 +11627,13 @@ function encodeReplayData(value, options = {}) {
         id: capabilityId,
         properties: child(entry.properties, "properties")
       };
+    } else if (nativeBoxedValue(entry) !== void 0) {
+      const properties = /* @__PURE__ */ Object.create(null);
+      nodes[id] = { kind: "boxed", value: child(nativeBoxedValue(entry), "<payload>"), properties, extensible: Object.isExtensible(entry) };
+      for (const [key, descriptor] of boxedDataProperties(entry)) {
+        if (!("value" in descriptor)) throw new TypeError(`Cannot record replay data accessor '${key}'.`);
+        properties[key] = { value: child(descriptor.value, JSON.stringify(["property", key])), configurable: descriptor.configurable === true, enumerable: descriptor.enumerable === true, writable: descriptor.writable === true };
+      }
     } else if (isSandboxDate(entry)) {
       nodes[id] = { kind: "date", time: serializedDateTime(entry) };
     } else if (isFloat32Array(entry)) {
@@ -11564,6 +11795,17 @@ function decodeReplayData(input, options = {}, parent) {
         options.onCapabilityRestored?.(capability, copy);
         return copy;
       }
+      if (kind === "boxed") {
+        validateBoxedProperties(node);
+        const payload = own(node, "value");
+        if (typeof payload !== "number" && typeof payload !== "string" && typeof payload !== "boolean" && (payload === null || typeof payload !== "object" || own(record(payload), "tag") !== "number"))
+          throw new TypeError("Invalid boxed primitive payload.");
+        const result3 = createSandboxBox(child(payload));
+        restored.set(id, result3);
+        defineProperties(result3, record(own(node, "properties")), child);
+        if (!node.extensible) Object.preventExtensions(result3);
+        return result3;
+      }
       if (kind === "date") {
         if (Object.keys(node).length !== 2) throw new TypeError("Invalid serialized Date fields.");
         const result3 = restoreDateTime(own(node, "time"));
@@ -24086,7 +24328,10 @@ function isArrayMethodName(property) {
 }
 async function callArrayMethod(receiver, methodName, args, options, stack = []) {
   if (receiver === null || receiver === void 0) throw new TypeError("Array method requires a receiver.");
-  if (typeof receiver !== "object") throw new TypeError("Object primitive boxing is not supported.");
+  if (typeof receiver !== "object") {
+    receiver = createSandboxBox(receiver);
+    options.budget.chargeDataUsage(measureSandboxData([receiver]));
+  }
   const retainedReceiver = {};
   options.budget.setRetainedValues(retainedReceiver, () => [receiver]);
   try {
@@ -24796,18 +25041,27 @@ function toIntegerOrInfinity(value) {
 // packages/safe-js/src/interp/methods/function.ts
 var functionMethodNames = /* @__PURE__ */ new Set(["apply", "bind", "call", "toString"]);
 function getFunctionMember(target, property, options) {
-  if (isGuestClosure(target)) {
-    const value = getGuestFunctionProperty(target, String(property));
-    if (value !== void 0 || Object.hasOwn(target.properties ?? {}, String(property))) return value;
-    if (!isFunctionMethodName(property)) return void 0;
-  }
-  const properties = target.properties;
-  if (properties !== void 0 && Object.hasOwn(properties, String(property))) {
-    return properties[String(property)];
-  }
-  if (property === "length") {
-    return target.length;
+  let current = target;
+  let depth = 0;
+  while (current !== null) {
+    if (isGuestClosure(current)) {
+      const value = getGuestFunctionProperty(current, String(property));
+      if (value !== void 0 || Object.hasOwn(current.properties ?? {}, String(property))) return value;
+    } else if (isSandboxClosure(current)) {
+      if (current.properties !== void 0 && Object.hasOwn(current.properties, String(property)))
+        return current.properties[String(property)];
+      if (property === "length") return current.length;
+    } else if (Object.hasOwn(current, String(property))) {
+      return current[String(property)];
+    }
+    if (isSandboxClosure(current) && !hasExplicitSandboxPrototype(current)) break;
+    current = getSandboxPrototype(current, options.budget);
+    if (current !== null) {
+      options.budget?.visitNode();
+      assertSandboxDataDepth(++depth);
+    }
   }
+  if (current === null) return void 0;
   if (property === "toString" && runResources.getStore()?.functionSourceText === false) return void 0;
   if (!isFunctionMethodName(property)) {
     return void 0;
@@ -24833,7 +25087,7 @@ function callFunctionMethod(target, methodName, args, options, stack) {
   const thisValue = args[0];
   if (methodName === "bind") {
     const boundArgs = args.slice(1);
-    return createSandboxClosure({
+    const bound = createSandboxClosure({
       guest: true,
       sandbox: true,
       name: `bound ${target.name ?? ""}`,
@@ -24851,6 +25105,9 @@ function callFunctionMethod(target, methodName, args, options, stack) {
         )
       }
     });
+    if (hasExplicitSandboxPrototype(target))
+      setSandboxPrototype(bound, getSandboxPrototype(target, options.budget), options.budget);
+    return bound;
   }
   if (methodName === "call") {
     return options.callClosure(target, args.slice(1), stack, thisValue);
@@ -24865,273 +25122,58 @@ function callFunctionMethod(target, methodName, args, options, stack) {
   return options.callClosure(target, applyArgs, stack, thisValue);
 }
 
-// packages/safe-js/src/interp/methods/collection-callback.ts
-var activeCallbacks = /* @__PURE__ */ new WeakMap();
-function enterKeyedCollectionCallback(target, keys, budget) {
-  let state = activeCallbacks.get(target);
-  if (state === void 0) {
-    state = { cursors: /* @__PURE__ */ new Set(), leaveRunning: enterRunningState(target) };
-    activeCallbacks.set(target, state);
-  }
-  const cursor = { budget, pending: /* @__PURE__ */ new Set() };
-  state.cursors.add(cursor);
-  const leave = () => {
-    if (!state.cursors.delete(cursor)) return;
-    cursor.pending.clear();
-    budget.setRetainedDataUsage(cursor, 0);
-    budget.setRetainedValues(cursor, void 0);
-    if (state.cursors.size === 0) {
-      activeCallbacks.delete(target);
-      state.leaveRunning();
-    }
-  };
-  try {
-    budget.setRetainedDataUsage(cursor, 1);
-    budget.setRetainedValues(cursor, () => cursor.pending);
-    for (const key of keys) updatePendingKeys(cursor, "add", key);
-  } catch (error) {
-    leave();
-    throw error;
-  }
-  return {
-    next: () => {
-      budget.visitNode();
-      for (const key of cursor.pending) {
-        cursor.pending.delete(key);
-        budget.setRetainedDataUsage(cursor, 1 + cursor.pending.size);
-        return { done: false, value: key };
-      }
-      return { done: true, value: void 0 };
-    },
-    leave
-  };
-}
-function updateKeyedCollectionCallbacks(target, mutation, key) {
-  const state = activeCallbacks.get(target);
-  if (state === void 0) return;
-  for (const cursor of state.cursors) updatePendingKeys(cursor, mutation, key);
-}
-function updatePendingKeys(cursor, mutation, key) {
-  const { budget, pending } = cursor;
-  budget.visitNode();
-  if (mutation === "add") {
-    const nextSize = pending.has(key) ? pending.size : pending.size + 1;
-    budget.allocateCollectionEntries(nextSize);
-    budget.setRetainedDataUsage(cursor, 1 + nextSize);
-    pending.add(key);
-  } else {
-    if (mutation === "delete") pending.delete(key);
-    else pending.clear();
-    budget.setRetainedDataUsage(cursor, 1 + pending.size);
-  }
-}
-
-// packages/safe-js/src/interp/methods/map.ts
-var mapMethodNames = /* @__PURE__ */ new Set([
-  "get",
-  "set",
-  "has",
-  "delete",
-  "clear",
-  "forEach",
-  "keys",
-  "values",
-  "entries"
+// packages/safe-js/src/interp/methods/string.ts
+var SPLIT_STRING_MESSAGE = "String#split only supports string separator values.";
+var stringMethodNames = /* @__PURE__ */ new Set([
+  "at",
+  "charAt",
+  "charCodeAt",
+  "codePointAt",
+  "concat",
+  "endsWith",
+  "includes",
+  "indexOf",
+  "isWellFormed",
+  "lastIndexOf",
+  "localeCompare",
+  "match",
+  "matchAll",
+  "normalize",
+  "padEnd",
+  "padStart",
+  "repeat",
+  "replace",
+  "replaceAll",
+  "slice",
+  "search",
+  "split",
+  "startsWith",
+  "substr",
+  "substring",
+  "toLowerCase",
+  "toUpperCase",
+  "toWellFormed",
+  "trim",
+  "trimEnd",
+  "trimStart"
 ]);
-function isMapMethodName(value) {
-  return typeof value === "string" && mapMethodNames.has(value);
-}
-function getMapMember(target, property, options) {
-  if (property === "size") {
-    return target.entries.size;
+function getStringMember(value, property, budget) {
+  const index = getStringIndex(property);
+  if (index !== void 0) {
+    return value[index];
   }
-  if (!isMapMethodName(property)) {
+  if (property === "length") {
+    return value.length;
+  }
+  if (!isStringMethodName(property)) {
     return void 0;
   }
   return createSandboxClosure({
     sandbox: true,
-    call: (args, context) => {
-      const receiver = context?.thisValue;
-      if (!isSandboxMap(receiver)) throw new TypeError(`Map#${property} requires a Map receiver.`);
-      return callMapMethod(receiver, property, args, options, context?.stack ?? []);
-    },
-    name: property
-  });
-}
-async function callMapMethod(target, methodName, args, options, stack = []) {
-  switch (methodName) {
-    case "get":
-      return target.entries.get(args[0]);
-    case "set": {
-      assertCollectionMutable(target);
-      const exists = target.entries.has(args[0]);
-      const nextSize = exists ? target.entries.size : target.entries.size + 1;
-      options.budget.allocateCollectionEntries(nextSize);
-      if (!exists) updateKeyedCollectionCallbacks(target, "add", args[0]);
-      target.entries.set(args[0], args[1]);
-      return target;
-    }
-    case "has":
-      return target.entries.has(args[0]);
-    case "delete": {
-      assertCollectionMutable(target);
-      const deleted = target.entries.delete(args[0]);
-      if (deleted) updateKeyedCollectionCallbacks(target, "delete", args[0]);
-      return deleted;
-    }
-    case "clear":
-      assertCollectionMutable(target);
-      target.entries.clear();
-      updateKeyedCollectionCallbacks(target, "clear");
-      return void 0;
-    case "forEach": {
-      const callback = args[0];
-      if (!isSandboxClosure(callback)) {
-        throw new TypeError("Map.prototype.forEach requires a callback function.");
-      }
-      const cursor = enterKeyedCollectionCallback(target, target.entries.keys(), options.budget);
-      try {
-        for (let entry = cursor.next(); !entry.done; entry = cursor.next()) {
-          const key = entry.value;
-          const value = target.entries.get(key);
-          await options.callClosure(callback, [value, key, target], stack, args[1]);
-        }
-      } finally {
-        cursor.leave();
-      }
-      return void 0;
-    }
-    case "keys":
-    case "values":
-    case "entries":
-      return createSandboxCollectionIterator(target, methodName);
-  }
-}
-
-// packages/safe-js/src/interp/methods/number.ts
-var numberMethodNames = /* @__PURE__ */ new Set([
-  "toExponential",
-  "toFixed",
-  "toPrecision",
-  "toString"
-]);
-function getNumberMember(property, budget) {
-  if (!isNumberMethodName(property)) {
-    return void 0;
-  }
-  return createSandboxClosure({
-    sandbox: true,
-    name: `Number#${property}`,
-    call: (args, context) => callNumberMethod(context?.thisValue, property, args, budget, context)
-  });
-}
-function isNumberMethodName(property) {
-  return typeof property === "string" && numberMethodNames.has(property);
-}
-function callNumberMethod(value, methodName, args, budget, context) {
-  if (typeof value !== "number") {
-    throw new TypeError(`Number#${methodName} requires a number receiver.`);
-  }
-  const argument = args[0];
-  if (argument !== null && typeof argument === "object") {
-    return formatObjectArgument(value, methodName, argument, budget, context);
-  }
-  return formatNumber(value, methodName, argument === void 0 ? void 0 : Number(argument), budget);
-}
-async function formatObjectArgument(value, methodName, argument, budget, context) {
-  const retainedArgument = {};
-  budget.setRetainedValues(retainedArgument, () => [argument]);
-  try {
-    const number = await sandboxNumber(argument, budget, context);
-    return formatNumber(value, methodName, number, budget);
-  } finally {
-    budget.setRetainedValues(retainedArgument, void 0);
-  }
-}
-function formatNumber(value, methodName, argument, budget) {
-  let result;
-  try {
-    result = value[methodName](argument);
-  } catch (error) {
-    if (!(error instanceof RangeError)) throw error;
-    const detail = methodName === "toString" ? "radix must be between 2 and 36." : methodName === "toPrecision" ? "precision must be between 1 and 100." : "digits must be between 0 and 100.";
-    throw new RangeError(`Number#${methodName} ${detail}`);
-  }
-  return budget.allocateString(result);
-}
-
-// packages/safe-js/src/interp/methods/generator.ts
-var generatorMethodNames = /* @__PURE__ */ new Set(["next", "return", "throw"]);
-function getGeneratorMember(target, property, budget) {
-  if (typeof property !== "string" || !generatorMethodNames.has(property)) {
-    return void 0;
-  }
-  return createSandboxClosure({
-    sandbox: true,
-    name: property,
-    call: async ([value]) => {
-      const iterator = getSandboxIterator(target);
-      const result = await iterator[property](value);
-      return allocateProducedSandboxValue(
-        { value: result.value, done: result.done === true },
-        budget
-      );
-    }
-  });
-}
-
-// packages/safe-js/src/interp/methods/string.ts
-var SPLIT_STRING_MESSAGE = "String#split only supports string separator values.";
-var stringMethodNames = /* @__PURE__ */ new Set([
-  "at",
-  "charAt",
-  "charCodeAt",
-  "codePointAt",
-  "concat",
-  "endsWith",
-  "includes",
-  "indexOf",
-  "isWellFormed",
-  "lastIndexOf",
-  "localeCompare",
-  "match",
-  "matchAll",
-  "normalize",
-  "padEnd",
-  "padStart",
-  "repeat",
-  "replace",
-  "replaceAll",
-  "slice",
-  "search",
-  "split",
-  "startsWith",
-  "substr",
-  "substring",
-  "toLowerCase",
-  "toUpperCase",
-  "toWellFormed",
-  "trim",
-  "trimEnd",
-  "trimStart"
-]);
-function getStringMember(value, property, budget) {
-  const index = getStringIndex(property);
-  if (index !== void 0) {
-    return value[index];
-  }
-  if (property === "length") {
-    return value.length;
-  }
-  if (!isStringMethodName(property)) {
-    return void 0;
-  }
-  return createSandboxClosure({
-    sandbox: true,
-    name: `String#${property}`,
-    ...property === "localeCompare" ? { length: 1 } : {},
-    ...property === "isWellFormed" || property === "toWellFormed" ? { length: 0 } : {},
-    call: async (args, context) => {
+    name: `String#${property}`,
+    ...property === "localeCompare" ? { length: 1 } : {},
+    ...property === "isWellFormed" || property === "toWellFormed" ? { length: 0 } : {},
+    call: async (args, context) => {
       const receiver = context?.thisValue;
       if (receiver === null || receiver === void 0) {
         throw new TypeError(`String#${property} requires a non-null receiver.`);
@@ -25559,30 +25601,246 @@ function callMatchLikeMethod(value, methodName, args, compilation, lastIndex) {
   if (methodName === "match" && matches.length === 0) return null;
   return methodName === "match" ? matches.map((match) => match.text) : matches.map((match) => toMatchArray(match, value));
 }
-function collectRegexMatches(regex, value, all, budget, lastIndex = 0) {
-  const matches = [];
-  do {
-    const match = executeRegex(regex, value, lastIndex);
-    if (match === null) break;
-    budget?.allocateArrayLength(matches.length + 1);
-    matches.push(match);
-    lastIndex = match.index + match.text.length;
-    if (all && match.text.length === 0) regex.lastIndex = ++lastIndex;
-  } while (all);
-  return matches;
+function collectRegexMatches(regex, value, all, budget, lastIndex = 0) {
+  const matches = [];
+  do {
+    const match = executeRegex(regex, value, lastIndex);
+    if (match === null) break;
+    budget?.allocateArrayLength(matches.length + 1);
+    matches.push(match);
+    lastIndex = match.index + match.text.length;
+    if (all && match.text.length === 0) regex.lastIndex = ++lastIndex;
+  } while (all);
+  return matches;
+}
+function splitString(value, separator, limit) {
+  const split = String.prototype.split;
+  return split.call(value, separator, limit);
+}
+function asNumber(value) {
+  return Number(value);
+}
+function asNumberOrUndefined(value) {
+  return value === void 0 ? void 0 : Number(value);
+}
+function asStringOrUndefined(value) {
+  return value === void 0 ? void 0 : String(value);
+}
+
+// packages/safe-js/src/interp/methods/collection-callback.ts
+var activeCallbacks = /* @__PURE__ */ new WeakMap();
+function enterKeyedCollectionCallback(target, keys, budget) {
+  let state = activeCallbacks.get(target);
+  if (state === void 0) {
+    state = { cursors: /* @__PURE__ */ new Set(), leaveRunning: enterRunningState(target) };
+    activeCallbacks.set(target, state);
+  }
+  const cursor = { budget, pending: /* @__PURE__ */ new Set() };
+  state.cursors.add(cursor);
+  const leave = () => {
+    if (!state.cursors.delete(cursor)) return;
+    cursor.pending.clear();
+    budget.setRetainedDataUsage(cursor, 0);
+    budget.setRetainedValues(cursor, void 0);
+    if (state.cursors.size === 0) {
+      activeCallbacks.delete(target);
+      state.leaveRunning();
+    }
+  };
+  try {
+    budget.setRetainedDataUsage(cursor, 1);
+    budget.setRetainedValues(cursor, () => cursor.pending);
+    for (const key of keys) updatePendingKeys(cursor, "add", key);
+  } catch (error) {
+    leave();
+    throw error;
+  }
+  return {
+    next: () => {
+      budget.visitNode();
+      for (const key of cursor.pending) {
+        cursor.pending.delete(key);
+        budget.setRetainedDataUsage(cursor, 1 + cursor.pending.size);
+        return { done: false, value: key };
+      }
+      return { done: true, value: void 0 };
+    },
+    leave
+  };
+}
+function updateKeyedCollectionCallbacks(target, mutation, key) {
+  const state = activeCallbacks.get(target);
+  if (state === void 0) return;
+  for (const cursor of state.cursors) updatePendingKeys(cursor, mutation, key);
+}
+function updatePendingKeys(cursor, mutation, key) {
+  const { budget, pending } = cursor;
+  budget.visitNode();
+  if (mutation === "add") {
+    const nextSize = pending.has(key) ? pending.size : pending.size + 1;
+    budget.allocateCollectionEntries(nextSize);
+    budget.setRetainedDataUsage(cursor, 1 + nextSize);
+    pending.add(key);
+  } else {
+    if (mutation === "delete") pending.delete(key);
+    else pending.clear();
+    budget.setRetainedDataUsage(cursor, 1 + pending.size);
+  }
+}
+
+// packages/safe-js/src/interp/methods/map.ts
+var mapMethodNames = /* @__PURE__ */ new Set([
+  "get",
+  "set",
+  "has",
+  "delete",
+  "clear",
+  "forEach",
+  "keys",
+  "values",
+  "entries"
+]);
+function isMapMethodName(value) {
+  return typeof value === "string" && mapMethodNames.has(value);
+}
+function getMapMember(target, property, options) {
+  if (property === "size") {
+    return target.entries.size;
+  }
+  if (!isMapMethodName(property)) {
+    return void 0;
+  }
+  return createSandboxClosure({
+    sandbox: true,
+    call: (args, context) => {
+      const receiver = context?.thisValue;
+      if (!isSandboxMap(receiver)) throw new TypeError(`Map#${property} requires a Map receiver.`);
+      return callMapMethod(receiver, property, args, options, context?.stack ?? []);
+    },
+    name: property
+  });
+}
+async function callMapMethod(target, methodName, args, options, stack = []) {
+  switch (methodName) {
+    case "get":
+      return target.entries.get(args[0]);
+    case "set": {
+      assertCollectionMutable(target);
+      const exists = target.entries.has(args[0]);
+      const nextSize = exists ? target.entries.size : target.entries.size + 1;
+      options.budget.allocateCollectionEntries(nextSize);
+      if (!exists) updateKeyedCollectionCallbacks(target, "add", args[0]);
+      target.entries.set(args[0], args[1]);
+      return target;
+    }
+    case "has":
+      return target.entries.has(args[0]);
+    case "delete": {
+      assertCollectionMutable(target);
+      const deleted = target.entries.delete(args[0]);
+      if (deleted) updateKeyedCollectionCallbacks(target, "delete", args[0]);
+      return deleted;
+    }
+    case "clear":
+      assertCollectionMutable(target);
+      target.entries.clear();
+      updateKeyedCollectionCallbacks(target, "clear");
+      return void 0;
+    case "forEach": {
+      const callback = args[0];
+      if (!isSandboxClosure(callback)) {
+        throw new TypeError("Map.prototype.forEach requires a callback function.");
+      }
+      const cursor = enterKeyedCollectionCallback(target, target.entries.keys(), options.budget);
+      try {
+        for (let entry = cursor.next(); !entry.done; entry = cursor.next()) {
+          const key = entry.value;
+          const value = target.entries.get(key);
+          await options.callClosure(callback, [value, key, target], stack, args[1]);
+        }
+      } finally {
+        cursor.leave();
+      }
+      return void 0;
+    }
+    case "keys":
+    case "values":
+    case "entries":
+      return createSandboxCollectionIterator(target, methodName);
+  }
+}
+
+// packages/safe-js/src/interp/methods/number.ts
+var numberMethodNames = /* @__PURE__ */ new Set([
+  "toExponential",
+  "toFixed",
+  "toPrecision",
+  "toString"
+]);
+function getNumberMember(property, budget) {
+  if (!isNumberMethodName(property)) {
+    return void 0;
+  }
+  return createSandboxClosure({
+    sandbox: true,
+    name: `Number#${property}`,
+    call: (args, context) => callNumberMethod(context?.thisValue, property, args, budget, context)
+  });
+}
+function isNumberMethodName(property) {
+  return typeof property === "string" && numberMethodNames.has(property);
 }
-function splitString(value, separator, limit) {
-  const split = String.prototype.split;
-  return split.call(value, separator, limit);
+function callNumberMethod(value, methodName, args, budget, context) {
+  if (isSandboxBox(value)) value = boxedValue(value);
+  if (typeof value !== "number") {
+    throw new TypeError(`Number#${methodName} requires a number receiver.`);
+  }
+  const argument = args[0];
+  if (argument !== null && typeof argument === "object") {
+    return formatObjectArgument(value, methodName, argument, budget, context);
+  }
+  return formatNumber(value, methodName, argument === void 0 ? void 0 : Number(argument), budget);
 }
-function asNumber(value) {
-  return Number(value);
+async function formatObjectArgument(value, methodName, argument, budget, context) {
+  const retainedArgument = {};
+  budget.setRetainedValues(retainedArgument, () => [argument]);
+  try {
+    const number = await sandboxNumber(argument, budget, context);
+    return formatNumber(value, methodName, number, budget);
+  } finally {
+    budget.setRetainedValues(retainedArgument, void 0);
+  }
 }
-function asNumberOrUndefined(value) {
-  return value === void 0 ? void 0 : Number(value);
+function formatNumber(value, methodName, argument, budget) {
+  let result;
+  try {
+    result = value[methodName](argument);
+  } catch (error) {
+    if (!(error instanceof RangeError)) throw error;
+    const detail = methodName === "toString" ? "radix must be between 2 and 36." : methodName === "toPrecision" ? "precision must be between 1 and 100." : "digits must be between 0 and 100.";
+    throw new RangeError(`Number#${methodName} ${detail}`);
+  }
+  return budget.allocateString(result);
 }
-function asStringOrUndefined(value) {
-  return value === void 0 ? void 0 : String(value);
+
+// packages/safe-js/src/interp/methods/generator.ts
+var generatorMethodNames = /* @__PURE__ */ new Set(["next", "return", "throw"]);
+function getGeneratorMember(target, property, budget) {
+  if (typeof property !== "string" || !generatorMethodNames.has(property)) {
+    return void 0;
+  }
+  return createSandboxClosure({
+    sandbox: true,
+    name: property,
+    call: async ([value]) => {
+      const iterator = getSandboxIterator(target);
+      const result = await iterator[property](value);
+      return allocateProducedSandboxValue(
+        { value: result.value, done: result.done === true },
+        budget
+      );
+    }
+  });
 }
 
 // packages/safe-js/src/interp/methods/set.ts
@@ -25719,7 +25977,11 @@ function createObjectGlobal(methods, budget) {
       budget.chargeDataUsage(1);
       return /* @__PURE__ */ Object.create(null);
     }
-    if (typeof value !== "object") throw new TypeError("Object primitive boxing is not supported.");
+    if (typeof value !== "object") {
+      const box = createSandboxBox(value);
+      budget.chargeDataUsage(measureSandboxData([box]));
+      return box;
+    }
     return value;
   };
   const constructor = createSandboxClosure({
@@ -25749,9 +26011,7 @@ function createObjectGlobal(methods, budget) {
       length: 0,
       call: (_args, context) => {
         const value = requireReceiver(context?.thisValue);
-        if (typeof value !== "object")
-          throw new TypeError("Object primitive boxing is not supported.");
-        return value;
+        return construct([value]);
       }
     }),
     hasOwnProperty: createSandboxClosure({
@@ -25819,6 +26079,7 @@ function hasOwnSandboxProperty(value, key, enumerable) {
   return descriptor !== void 0 && (!enumerable || descriptor.enumerable === true);
 }
 function typeTag(value) {
+  if (isSandboxBox(value)) value = boxedValue(value);
   if (value === void 0) return "Undefined";
   if (value === null) return "Null";
   if (typeof value === "string") return "String";
@@ -25923,12 +26184,12 @@ function isSandboxSetConstructor(value) {
 function populateCollection(source, collection, { name, budget, context, append, retainedValues }) {
   budget.allocateCollectionEntries(0);
   if (source === void 0 || source === null) return collection;
-  const iterator = getSandboxIterator(source, budget);
+  const iterator = getSandboxIterator(source, budget, context);
   if (iterator === void 0) throw new TypeError(`${name} constructor requires an iterable.`);
   let entry;
   let failure;
   const retained = {};
-  budget.setRetainedValues(retained, () => [source, collection, entry, failure, ...retainedValues?.() ?? []]);
+  budget.setRetainedValues(retained, () => [source, iterator.retainedValue, collection, entry, failure, ...retainedValues?.() ?? []]);
   const checkData = createDataCheckpoint(budget, context);
   const closeOnThrow = (error) => {
     failure = isCapturedException(error) ? error.reason : error;
@@ -25938,7 +26199,7 @@ function populateCollection(source, collection, { name, budget, context, append,
     };
     try {
       const closing = iterator.return?.();
-      if (iterator.generator) return Promise.resolve(closing).then(() => {
+      if (iterator.generator || iterator.asynchronous) return Promise.resolve(closing).then(() => {
         throw error;
       }, rethrow);
     } catch (closeError) {
@@ -25960,7 +26221,7 @@ function populateCollection(source, collection, { name, budget, context, append,
     }
     return false;
   };
-  if (iterator.generator) {
+  if (iterator.generator || iterator.asynchronous) {
     return (async () => {
       try {
         checkData(collection, 0, true);
@@ -26915,22 +27176,29 @@ async function evaluateBinaryExpression(node, context) {
   if (left.kind !== "normal") {
     return left;
   }
+  let leftValue = left.value;
   let rightValue;
-  const release = retainValues(context.budget, () => [left.value, rightValue]);
+  const release = retainValues(context.budget, () => [leftValue, rightValue]);
   try {
     const right = await evaluateNode(node.right, context);
     if (right.kind !== "normal") {
       return right;
     }
     rightValue = right.value;
-    let leftValue = left.value;
     if (node.operator === "in") {
       if (typeof right.value !== "object" || right.value === null) {
         throw new TypeError("Right-hand side of 'in' must be an object.");
       }
       leftValue = await toPropertyKey(leftValue, context.budget, createCoercionContext(context));
     }
-    const value = applyBinaryOperator(node, leftValue, right.value, context);
+    if (!["in", "instanceof", "===", "!=="].includes(node.operator)) {
+      const equality = node.operator === "==" || node.operator === "!=";
+      if (isSandboxBox(leftValue) && (!equality || rightValue !== null && rightValue !== void 0 && typeof rightValue !== "object"))
+        leftValue = await toNumericPrimitive(leftValue, context);
+      if (isSandboxBox(rightValue) && (!equality || left.value !== null && left.value !== void 0 && typeof left.value !== "object"))
+        rightValue = await toNumericPrimitive(rightValue, context);
+    }
+    const value = applyBinaryOperator(node, leftValue, rightValue, context);
     return {
       kind: "normal",
       hasValue: true,
@@ -27518,63 +27786,68 @@ async function evaluateForOfStatement(node, context) {
   };
 }
 async function evaluateForOfIterator(node, value, context, restoredEntry) {
-  const iterator = getSandboxIterator(value, context.budget);
+  const iterator = getSandboxIterator(value, context.budget, createCoercionContext(context));
   if (iterator === void 0) {
     throw new TypeError(`${String(value)} is not a supported iterable`);
   }
-  const nodeId = node.nodeId ?? -1;
-  let index = consumeRestoredLoopIterationIndex(node, context);
-  for (let skipped = 0; skipped < index; skipped += 1) {
-    const skippedIteration = await iterator.next();
-    if (typeof skippedIteration !== "object" || skippedIteration === null) {
-      throw new TypeError("Iterator result must be an object.");
-    }
-    if (skippedIteration.done) {
-      return normalEmptyResult();
-    }
-  }
-  while (true) {
-    const iteration = restoredEntry ?? await iterator.next();
-    restoredEntry = void 0;
-    if (typeof iteration !== "object" || iteration === null) {
-      throw new TypeError("Iterator result must be an object.");
-    }
-    if (iteration.done) {
-      context.activeLoopIterations.delete(nodeId);
-      return normalEmptyResult();
-    }
-    context.activeLoopIterations.set(
-      nodeId,
-      iterator.snapshotIndex === void 0 ? index : {
-        get index() {
-          return iterator.snapshotIndex();
-        },
-        values: [value, iteration.value]
+  const releaseIterator = retainValues(context.budget, () => [value, iterator.retainedValue]);
+  try {
+    const nodeId = node.nodeId ?? -1;
+    let index = consumeRestoredLoopIterationIndex(node, context);
+    for (let skipped = 0; skipped < index; skipped += 1) {
+      const skippedIteration = await iterator.next();
+      if (typeof skippedIteration !== "object" || skippedIteration === null) {
+        throw new TypeError("Iterator result must be an object.");
+      }
+      if (skippedIteration.done) {
+        return normalEmptyResult();
       }
-    );
-    const scope = context.scope.child();
-    const binding = await bindForOfLoopVariable(node.left, iteration.value, scope, context);
-    if (!binding.ok) {
-      return binding.result;
-    }
-    const iterationContext = createLoopIterationContext(context, scope);
-    emitLoopIterationBreakpoint(node, iterationContext);
-    const result = await evaluateNode(node.body, iterationContext);
-    if (isMatchingBreak(result, loopLabels(node))) {
-      context.activeLoopIterations.delete(nodeId);
-      await closeIterator(iterator);
-      return normalEmptyResult();
     }
-    if (isMatchingContinue(result, loopLabels(node))) {
+    while (true) {
+      const iteration = restoredEntry ?? await iterator.next();
+      restoredEntry = void 0;
+      if (typeof iteration !== "object" || iteration === null) {
+        throw new TypeError("Iterator result must be an object.");
+      }
+      if (iteration.done) {
+        context.activeLoopIterations.delete(nodeId);
+        return normalEmptyResult();
+      }
+      context.activeLoopIterations.set(
+        nodeId,
+        iterator.snapshotIndex === void 0 ? index : {
+          get index() {
+            return iterator.snapshotIndex();
+          },
+          values: [value, iteration.value]
+        }
+      );
+      const scope = context.scope.child();
+      const binding = await bindForOfLoopVariable(node.left, iteration.value, scope, context);
+      if (!binding.ok) {
+        return binding.result;
+      }
+      const iterationContext = createLoopIterationContext(context, scope);
+      emitLoopIterationBreakpoint(node, iterationContext);
+      const result = await evaluateNode(node.body, iterationContext);
+      if (isMatchingBreak(result, loopLabels(node))) {
+        context.activeLoopIterations.delete(nodeId);
+        await closeIterator(iterator);
+        return normalEmptyResult();
+      }
+      if (isMatchingContinue(result, loopLabels(node))) {
+        index += 1;
+        continue;
+      }
+      if (result.kind !== "normal") {
+        context.activeLoopIterations.delete(nodeId);
+        await closeIterator(iterator);
+        return result;
+      }
       index += 1;
-      continue;
-    }
-    if (result.kind !== "normal") {
-      context.activeLoopIterations.delete(nodeId);
-      await closeIterator(iterator);
-      return result;
     }
-    index += 1;
+  } finally {
+    releaseIterator();
   }
 }
 async function evaluateForInStatement(node, context) {
@@ -27944,52 +28217,64 @@ async function evaluateYieldDelegate(node, context) {
   if (argument.kind !== "normal") {
     return argument;
   }
-  const iterator = getSandboxIterator(argument.value, context.budget);
+  const iterator = getSandboxIterator(
+    argument.value,
+    context.budget,
+    createCoercionContext(context)
+  );
   if (iterator === void 0) {
     throw new TypeError(`${String(argument.value)} is not a supported iterable`);
   }
-  let completion = {
-    type: "normal",
-    value: void 0
-  };
-  const replay = context.generatorResume?.sent ?? [];
-  let replayIndex = 0;
-  while (true) {
-    const method = completion.type === "normal" ? "next" : completion.type;
-    const iteratorMethod = iterator[method];
-    if (iteratorMethod === void 0) {
-      if (completion.type === "throw") {
-        throw completion.value;
+  const releaseIterator = retainValues(context.budget, () => [
+    argument.value,
+    iterator.retainedValue
+  ]);
+  try {
+    let completion = {
+      type: "normal",
+      value: void 0
+    };
+    const replay = context.generatorResume?.sent ?? [];
+    let replayIndex = 0;
+    while (true) {
+      const method = completion.type === "normal" ? "next" : completion.type;
+      const iteratorMethod = iterator[method];
+      if (iteratorMethod === void 0) {
+        if (completion.type === "throw") {
+          throw completion.value;
+        }
+        return generatorCompletionResult(completion);
       }
-      return generatorCompletionResult(completion);
-    }
-    const result = await iteratorMethod(completion.value);
-    if (result.done) {
-      if (completion.type === "return") {
-        return generatorCompletionResult({ type: "return", value: result.value });
+      const result = await iteratorMethod(completion.value);
+      if (result.done) {
+        if (completion.type === "return") {
+          return generatorCompletionResult({ type: "return", value: result.value });
+        }
+        return {
+          kind: "normal",
+          hasValue: true,
+          value: result.value
+        };
       }
-      return {
-        kind: "normal",
-        hasValue: true,
-        value: result.value
-      };
-    }
-    if (replayIndex < replay.length - 1) {
-      completion = replay[replayIndex + 1];
-      replayIndex += 1;
-      continue;
+      if (replayIndex < replay.length - 1) {
+        completion = replay[replayIndex + 1];
+        replayIndex += 1;
+        continue;
+      }
+      const completionPromise = context.generatorYield(
+        allocateProducedSandboxValue(result.value, context.budget),
+        node.nodeId
+      );
+      emitResumeBreakpoint(context, {
+        kind: "generator-yield",
+        nodeId: node.nodeId,
+        span: node.span
+      });
+      completion = await completionPromise;
+      context.generatorResume = void 0;
     }
-    const completionPromise = context.generatorYield(
-      allocateProducedSandboxValue(result.value, context.budget),
-      node.nodeId
-    );
-    emitResumeBreakpoint(context, {
-      kind: "generator-yield",
-      nodeId: node.nodeId,
-      span: node.span
-    });
-    completion = await completionPromise;
-    context.generatorResume = void 0;
+  } finally {
+    releaseIterator();
   }
 }
 function generatorCompletionResult(completion) {
@@ -28136,6 +28421,14 @@ async function evaluateMemberExpression(node, context) {
 }
 function getPropertyValue(target, property, context) {
   if (isGuestHostObject(target)) return getHostObjectMember(target, String(property));
+  if (typeof target === "string" || typeof target === "number" || typeof target === "boolean") {
+    const prototype = getBoxedPrototype(target, context.budget);
+    if (prototype !== void 0) {
+      if (typeof target === "string" && (property === "length" || getStringIndex(property) !== void 0))
+        return getStringMember(target, property, context.budget);
+      return getMemberValue(prototype, property, context);
+    }
+  }
   if (typeof target === "string") return getStringMember(target, property, context.budget);
   if (typeof target === "number") return getNumberMember(property, context.budget);
   if (typeof target === "boolean") return void 0;
@@ -28307,6 +28600,15 @@ async function evaluateMemberCallExpression(node, context) {
       ...reference,
       property: await toPropertyKey(reference.property, context.budget, createCoercionContext(context))
     };
+    if ((typeof member.object === "string" || typeof member.object === "number" || typeof member.object === "boolean") && getBoxedPrototype(member.object, context.budget) !== void 0) {
+      if (isDefaultBoxedMethod(member.object, member.property, context.budget)) {
+        if (typeof member.object === "string" && isStringMethodName(member.property))
+          return evaluateStringMethodCall(node, member.object, member.property, context);
+        if (typeof member.object === "number" && isNumberMethodName(member.property))
+          return evaluateNumberMethodCall(node, member.object, member.property, context);
+      }
+      return evaluateResolvedCallExpression(node, getPropertyValue(member.object, member.property, context), context, member.object);
+    }
     if (typeof member.object === "string" && isStringMethodName(member.property)) {
       return evaluateStringMethodCall(node, member.object, member.property, context);
     }
@@ -28656,7 +28958,7 @@ function hasSandboxProperty(value, key, context) {
   while (typeof current === "object" && current !== null) {
     if (isGuestHostObject(current)) return hasHostObjectMember(current, key);
     if (hasOwnSandboxProperty(current, key, false)) return true;
-    if (Array.isArray(current) || !isPlainSandboxObject(current) || isSandboxDate(current) || isFloat32Array(current) || isSandboxGenerator(current) || isSandboxCollectionIterator(current)) {
+    if (!(isGuestClosure(current) && hasExplicitSandboxPrototype(current)) && (Array.isArray(current) || !isPlainSandboxObject(current) || isSandboxDate(current) || isFloat32Array(current) || isSandboxGenerator(current) || isSandboxCollectionIterator(current))) {
       return getPropertyValue(current, key, context) !== void 0;
     }
     current = getSandboxPrototype(current, context.budget);
@@ -28668,33 +28970,41 @@ function hasSandboxProperty(value, key, context) {
   return false;
 }
 async function applyCompoundAssignmentOperator(operator, left, right, context) {
-  left = await toNumericPrimitive(left, context);
-  right = await toNumericPrimitive(right, context);
-  switch (operator) {
-    case "+=":
-      return applyAdditionOperator(left, right, context);
-    case "-=":
-      return toNumber(left) - toNumber(right);
-    case "*=":
-      return toNumber(left) * toNumber(right);
-    case "/=":
-      return toNumber(left) / toNumber(right);
-    case "%=":
-      return toNumber(left) % toNumber(right);
-    case "**=":
-      return toNumber(left) ** toNumber(right);
-    case "&=":
-      return toNumber(left) & toNumber(right);
-    case "|=":
-      return toNumber(left) | toNumber(right);
-    case "^=":
-      return toNumber(left) ^ toNumber(right);
-    case "<<=":
-      return toNumber(left) << toNumber(right);
-    case ">>=":
-      return toNumber(left) >> toNumber(right);
-    case ">>>=":
-      return toNumber(left) >>> toNumber(right);
+  const convertingObject = typeof left === "object" && left !== null;
+  let convertedLeft;
+  const release = retainValues(context.budget, () => [convertedLeft]);
+  try {
+    left = await toNumericPrimitive(left, context);
+    if (convertingObject) convertedLeft = left;
+    right = await toNumericPrimitive(right, context);
+    switch (operator) {
+      case "+=":
+        return applyAdditionOperator(left, right, context);
+      case "-=":
+        return toNumber(left) - toNumber(right);
+      case "*=":
+        return toNumber(left) * toNumber(right);
+      case "/=":
+        return toNumber(left) / toNumber(right);
+      case "%=":
+        return toNumber(left) % toNumber(right);
+      case "**=":
+        return toNumber(left) ** toNumber(right);
+      case "&=":
+        return toNumber(left) & toNumber(right);
+      case "|=":
+        return toNumber(left) | toNumber(right);
+      case "^=":
+        return toNumber(left) ^ toNumber(right);
+      case "<<=":
+        return toNumber(left) << toNumber(right);
+      case ">>=":
+        return toNumber(left) >> toNumber(right);
+      case ">>>=":
+        return toNumber(left) >>> toNumber(right);
+    }
+  } finally {
+    release();
   }
 }
 function applyAdditionOperator(left, right, context) {
@@ -29091,12 +29401,12 @@ async function evaluateSpreadElement(node, context) {
       result: value
     };
   }
-  const iterator = getSandboxIterator(value.value, context.budget);
+  const iterator = getSandboxIterator(value.value, context.budget, createCoercionContext(context));
   if (iterator === void 0) {
     throw new TypeError("Spread arguments must evaluate to an iterable.");
   }
   const spreadValues = [];
-  const release = retainValues(context.budget, () => [value.value, ...spreadValues]);
+  const release = retainValues(context.budget, () => [value.value, iterator.retainedValue, ...spreadValues]);
   try {
     while (true) {
       const next = await iterator.next();
@@ -30176,6 +30486,30 @@ function copyHostValueToSandbox(value, stackFrames, options, state, path) {
       state
     );
   }
+  const primitive = nativeBoxedValue(value);
+  if (primitive !== void 0) {
+    if (typeof primitive === "string") budget.allocateString(primitive);
+    const original = value;
+    const existing = state.seen.get(original);
+    if (existing !== void 0) return existing;
+    const copy = createSandboxBox(primitive);
+    state.seen.set(original, copy);
+    budget.chargeDataUsage(measureSandboxData([copy]));
+    for (const [key, descriptor] of boxedDataProperties(original)) {
+      if (!("value" in descriptor)) throw new TypeError(`Unsupported sandbox value at ${joinPath2(path, key)}: accessor property`);
+      Object.defineProperty(copy, budget.allocateString(key), {
+        ...descriptor,
+        value: copyHostValueToSandbox(
+          descriptor.value,
+          stackFrames,
+          { ...options, capabilityPath: [...options.capabilityPath ?? [], key] },
+          state,
+          joinPath2(path, key)
+        )
+      });
+    }
+    return copy;
+  }
   const date = copyNativeDate(value);
   if (date !== void 0) {
     const existing = state.seen.get(value);
@@ -30585,7 +30919,7 @@ function createReplayableRandom(options = {}) {
 
 // packages/safe-js/src/realm.ts
 import { AsyncLocalStorage as AsyncLocalStorage6 } from "node:async_hooks";
-import { types as types5 } from "node:util";
+import { types as types6 } from "node:util";
 
 // packages/safe-js/src/interp/globals/console-json.ts
 function createConsoleJsonGlobals(options) {
@@ -30594,12 +30928,18 @@ function createConsoleJsonGlobals(options) {
     JSON: {
       parse: createSandboxClosure({
         sandbox: true,
-        call: async ([text]) => parseJson(text, options.budget),
+        call: async ([text], context) => {
+          const converted = sandboxString(text, options.budget, context);
+          return copyJsonToSandbox(
+            JSON.parse(converted instanceof Promise ? await converted : converted),
+            options.budget
+          );
+        },
         name: "parse"
       }),
       stringify: createSandboxClosure({
         sandbox: true,
-        call: async ([value, replacer, indent]) => stringifyJson(value, replacer, indent, options.budget),
+        call: async ([value, replacer, indent], context) => stringifyJson(value, replacer, indent, options.budget, context),
         name: "stringify"
       })
     },
@@ -30660,11 +31000,7 @@ function createConsoleJsonGlobals(options) {
     )
   };
 }
-function parseJson(input, budget) {
-  const text = budget.allocateString(toJsonParseText(input));
-  return copyJsonToSandbox(JSON.parse(text), budget);
-}
-async function stringifyJson(value, replacer, indent, budget) {
+async function stringifyJson(value, replacer, indent, budget, context) {
   if (replacer !== void 0 && replacer !== null && !isSandboxClosure(replacer)) {
     throw new TypeError(
       "JSON.stringify(value, replacer, indent) only supports function, null, or undefined replacers."
@@ -30679,6 +31015,7 @@ async function stringifyJson(value, replacer, indent, budget) {
   defineDataProperty(holder, "", value);
   const output = await stringifyProperty("", holder, {
     budget,
+    context,
     gap: normalizeStringifyGap(indent),
     replacer: isSandboxClosure(replacer) ? replacer : void 0,
     stack: []
@@ -30688,15 +31025,6 @@ async function stringifyJson(value, replacer, indent, budget) {
   }
   return budget.allocateString(output);
 }
-function toJsonParseText(input) {
-  if (Array.isArray(input)) {
-    return input.map((entry) => entry === null || entry === void 0 ? "" : toJsonParseText(entry)).join(",");
-  }
-  if (typeof input === "object" && input !== null) {
-    return "[object Object]";
-  }
-  return String(input);
-}
 async function stringifyProperty(key, holder, state, indent = "") {
   let value = getOwnDataValue(holder, key);
   if (isSandboxDate(value)) {
@@ -30713,6 +31041,10 @@ async function stringifyProperty(key, holder, state, indent = "") {
   return stringifyValue(value, state, indent);
 }
 async function stringifyValue(value, state, indent) {
+  if (isSandboxBox(value)) {
+    const primitive = boxedValue(value);
+    value = typeof primitive === "number" ? await sandboxNumber(value, state.budget, state.context) : typeof primitive === "string" ? await sandboxString(value, state.budget, state.context) : primitive;
+  }
   if (value === null) {
     return "null";
   }
@@ -30997,7 +31329,7 @@ function structuredCloneSandboxValue(value, budget, parent) {
   const operation = budget.acquireCompileOwner(false, parent?.owner);
   const compilation = parent?.owner === operation.owner ? parent : new CompileScope(operation.owner);
   try {
-    const clone = cloneSandboxValue(value, { compilation, resetRegexLastIndex: true });
+    const clone = cloneSandboxValue(value, { compilation, resetRegexLastIndex: true, structuredClone: true });
     assertSandboxGraphDepth(clone);
     assertStructuredCloneable(clone, /* @__PURE__ */ new WeakSet());
     allocateProducedSandboxValue(clone, budget);
@@ -31034,6 +31366,72 @@ function assertStructuredCloneable(value, seen) {
   }
 }
 
+// packages/safe-js/src/interp/globals/primitives.ts
+function createPrimitiveConstructor(options, budget) {
+  const initial = { Number: 0, String: "", Boolean: false }[options.name];
+  const kind = typeof initial;
+  const prototype = createSandboxBox(initial);
+  const allocate = (value) => {
+    const box = createSandboxBox(value);
+    budget.chargeDataUsage(measureSandboxData([box]));
+    return box;
+  };
+  const constructor = createSandboxClosure({
+    guest: true,
+    sandbox: true,
+    name: options.name,
+    length: 1,
+    call: options.call,
+    construct: (args, context) => {
+      const value = options.call(args, context);
+      return value instanceof Promise ? value.then(allocate) : allocate(value);
+    }
+  });
+  const properties = materializeFunctionProperties(constructor);
+  Object.defineProperty(properties, "prototype", { value: prototype, writable: false });
+  Object.defineProperty(prototype, "constructor", {
+    value: constructor,
+    writable: true,
+    configurable: true
+  });
+  for (const [name, value] of Object.entries(options.properties ?? {}))
+    Object.defineProperty(properties, name, {
+      value,
+      writable: isSandboxClosure(value),
+      configurable: isSandboxClosure(value)
+    });
+  const methods = /* @__PURE__ */ new Map([
+    [
+      "valueOf",
+      createSandboxClosure({
+        sandbox: true,
+        name: "valueOf",
+        length: 0,
+        call: (_args, context) => primitiveReceiver(context?.thisValue, kind)
+      })
+    ]
+  ]);
+  if (kind === "number") {
+    for (const name of numberMethodNames) methods.set(name, getNumberMember(name, budget));
+  } else {
+    methods.set(
+      "toString",
+      createSandboxClosure({
+        sandbox: true,
+        name: "toString",
+        length: 0,
+        call: (_args, context) => budget.allocateString(String(primitiveReceiver(context?.thisValue, kind)))
+      })
+    );
+    if (kind === "string")
+      for (const name of stringMethodNames) methods.set(name, getStringMember("", name, budget));
+  }
+  for (const [name, value] of methods)
+    Object.defineProperty(prototype, name, { value, writable: true, configurable: true });
+  installBoxedPrototype(budget, prototype, constructor);
+  return constructor;
+}
+
 // packages/safe-js/src/interp/globals/object-array.ts
 function createObjectArrayGlobals(options) {
   return {
@@ -31099,6 +31497,7 @@ function createObjectArrayGlobals(options) {
         sandbox: true,
         call: ([value]) => {
           if (isSandboxDate(value)) return getDatePrototype(value, options.budget, options.compileOwner);
+          if (value !== null && value !== void 0 && typeof value !== "object") value = createSandboxBox(value);
           objectProperties(value);
           return getSandboxPrototype(value, options.budget);
         },
@@ -31138,11 +31537,11 @@ function createObjectArrayGlobals(options) {
       fromEntries: createSandboxClosure({
         sandbox: true,
         call: ([value], context) => {
-          const iterator = getSandboxIterator(value, options.budget);
+          const iterator = getSandboxIterator(value, options.budget, context);
           if (iterator === void 0) {
             throw new TypeError("Object.fromEntries requires an iterable.");
           }
-          if (context === void 0 && !iterator.generator) {
+          if (context === void 0 && !iterator.generator && !iterator.asynchronous) {
             return allocateProducedSandboxValue(
               Object.setPrototypeOf(
                 Reflect.apply(Object.fromEntries, Object, [{ [Symbol.iterator]: () => iterator }]),
@@ -31200,8 +31599,7 @@ function createObjectArrayGlobals(options) {
         })
       }
     }),
-    String: createSandboxClosure({
-      sandbox: true,
+    String: createPrimitiveConstructor({
       call: (args, context) => sandboxString(args.length === 0 ? "" : args[0], options.budget, context),
       name: "String",
       properties: {
@@ -31221,9 +31619,8 @@ function createObjectArrayGlobals(options) {
           name: "fromCodePoint"
         })
       }
-    }),
-    Number: createSandboxClosure({
-      sandbox: true,
+    }, options.budget),
+    Number: createPrimitiveConstructor({
       call: (args, context) => sandboxNumber(args.length === 0 ? 0 : args[0], options.budget, context),
       name: "Number",
       properties: {
@@ -31257,12 +31654,11 @@ function createObjectArrayGlobals(options) {
         NEGATIVE_INFINITY: Number.NEGATIVE_INFINITY,
         POSITIVE_INFINITY: Number.POSITIVE_INFINITY
       }
-    }),
-    Boolean: createSandboxClosure({
-      sandbox: true,
+    }, options.budget),
+    Boolean: createPrimitiveConstructor({
       call: ([value]) => Boolean(value),
       name: "Boolean"
-    })
+    }, options.budget)
   };
 }
 async function objectFromSandboxEntries(items, iterator, budget, context) {
@@ -31272,7 +31668,7 @@ async function objectFromSandboxEntries(items, iterator, budget, context) {
   let value;
   let failure;
   const retained = {};
-  budget.setRetainedValues(retained, () => [items, object, entry, key, value, failure]);
+  budget.setRetainedValues(retained, () => [items, iterator.retainedValue, object, entry, key, value, failure]);
   const checkData = createDataCheckpoint(budget, context);
   const closeOnThrow = async (error) => {
     failure = isCapturedException(error) ? error.reason : error;
@@ -31323,6 +31719,10 @@ function assignSandboxValues(target, sources, budget) {
   if (target === null || target === void 0) {
     throw new TypeError("Object.assign(target, ...sources) requires a non-null target.");
   }
+  if (typeof target !== "object") {
+    target = createSandboxBox(target);
+    budget.chargeDataUsage(measureSandboxData([target]));
+  }
   if (!isGuestClosure(target) && !isAssignableSandboxTarget(target)) {
     throw new TypeError("Object.assign(target, ...sources) requires an object or array target.");
   }
@@ -31392,13 +31792,13 @@ async function arrayFromSandboxValues(args, budget, context) {
     throw new TypeError("Array.from requires a non-null input.");
   }
   const read = (property) => context?.getProperty !== void 0 ? context.getProperty(items, property) : getSandboxDataProperty(items, property, budget);
-  const iterator = getSandboxIterator(items, budget);
+  const iterator = getSandboxIterator(items, budget, context);
   const constructor = context?.thisValue;
   let result;
   let currentValue;
   let failure;
   const retained = {};
-  budget.setRetainedValues(retained, () => [items, mapFn, constructor, result, currentValue, failure]);
+  budget.setRetainedValues(retained, () => [items, iterator?.retainedValue, mapFn, constructor, result, currentValue, failure]);
   const checkData = createDataCheckpoint(budget, context);
   const closeOnThrow = async (error) => {
     failure = isCapturedException(error) ? error.reason : error;
@@ -31657,7 +32057,7 @@ var RealmState = class {
         throw new TypeError("Realm limits must be positive safe integers with supported names.");
       this.limits[name] = Number(value);
     }
-    if (options.extensions !== void 0 && (!Array.isArray(options.extensions) || types5.isProxy(options.extensions)))
+    if (options.extensions !== void 0 && (!Array.isArray(options.extensions) || types6.isProxy(options.extensions)))
       throw new TypeError("Extensions must be a registration array.");
     const registrations = options.extensions ?? [];
     const extensions = [];
@@ -31892,7 +32292,7 @@ var RealmState = class {
     return this.phase.run(phase, () => {
       try {
         const result = call();
-        if (types5.isPromise(result) || phase.pending.size > 0 || phase.failure !== void 0) {
+        if (types6.isPromise(result) || phase.pending.size > 0 || phase.failure !== void 0) {
           return Promise.resolve(result).then(
             async (value) => {
               await Promise.allSettled(phase.pending);
@@ -31961,7 +32361,7 @@ var RealmState = class {
       },
       read: (operation, validate) => {
         const value = this.invokeHost(operation, operation);
-        if (types5.isPromise(value)) {
+        if (types6.isPromise(value)) {
           void Promise.resolve(value).catch(() => void 0);
           throw new TypeError("Live property operations must be synchronous.");
         }
@@ -31969,7 +32369,7 @@ var RealmState = class {
       },
       write: (operation, value) => {
         const result = this.invokeHost(operation, () => operation(this.exportValue(value)));
-        if (types5.isPromise(result)) {
+        if (types6.isPromise(result)) {
           void Promise.resolve(result).catch(() => void 0);
           throw new TypeError("Live property setters must be synchronous.");
         }
@@ -32178,7 +32578,7 @@ var RealmState = class {
         }
       });
       const output = getExtensionSetup(extension)(context);
-      if (types5.isPromise(output)) {
+      if (types6.isPromise(output)) {
         void Promise.resolve(output).catch(() => void 0);
         throw new TypeError("Extension setup must be synchronous.");
       }
@@ -32370,7 +32770,7 @@ var RealmState = class {
 };
 function readModules(input) {
   const entries = (value, label) => {
-    if (types5.isMap(value) && !types5.isProxy(value)) {
+    if (types6.isMap(value) && !types6.isProxy(value)) {
       const result = [...Map.prototype.entries.call(value)];
       if (result.length > 4096 || result.some(([key]) => typeof key !== "string" || key.length === 0))
         throw new TypeError(`${label} requires bounded string keys.`);
@@ -33615,4 +34015,4 @@ export {
   FileSnapshotBackend,
   run
 };
-//# sourceMappingURL=chunk-VKGWGZBH.js.map
+//# sourceMappingURL=chunk-XO7B4P27.js.map